When to pick Valimail over Red Sift OnDMARC

An SPF protocol limit and a plan entitlement are different facts. RFC 7208 tells the receiver’s SPF evaluator to stop after 10 mechanisms and modifiers that query DNS. Past that the result is a PermError, which is not an SPF pass. That limit is the DNS specification. It is not a line on a vendor plan.

The repair is a sequence. Name every sender, keep the SPF answer a receiver evaluates inside the protocol limit, sign with a DKIM key that aligns to the visible From domain, then move the published DMARC policy from p=none to quarantine and only after that to p=reject. Publishing p=reject is a request. RFC 7489 describes the domain owner as asking receivers to reject mail that fails the DMARC check. A mailbox provider may honor that request, ignore it, or apply its own handling. The DNS record does not force the provider to drop the message. A secure email gateway still decides what to do with mail that arrives. Publishing this policy is a different purchase. That gateway comparison is Proofpoint vs Mimecast. The wider shortlist of hosted reporters is DMARC tools.

Plan entitlements are the other number. Valimail’s pricing table gives Monitor 10 SPF lookups and marks Instant SPF unlimited on Enforce Starter, Premium, and Enterprise. Valimail describes Instant SPF as a macro generated for each query, and says the answer is not a flattened IP list. Monitor does not include that unlimited line, and the DNS edit stays with you. Red Sift OnDMARC Dynamic SPF is one include. Red Sift describes it as flattening at query time, without macros, and the Dynamic SPF help article says compaction keeps the evaluated answer inside the protocol limit of 10. Unlimited Dynamic SPF is not an Express entitlement. Express includes up to 10 SPF lookups, four domains, and 1 million emails a month. Unlimited on a plan is not a repeal of RFC 7208.

The tier above that cap is where the rest of the delegation sits: DKIM changes inside the product, hosted MTA-STS, and BIMI as either Valimail Amplify or a VMC line on OnDMARC Enterprise and Premier. A public price covers only Express. Enforce, and every OnDMARC tier above Express, is still a quote.

	Valimail	Red Sift OnDMARC
Primary use case	Hosted DMARC, SPF, and DKIM for domains you send from. Instant SPF is the Enforce entitlement aimed at the RFC 7208 limit of 10 DNS lookups	Hosted DMARC, SPF, and DKIM, plus MTA-STS, TLS-RPT, and BIMI record management. Unlimited Dynamic SPF is a plan entitlement above Express. The protocol limit of 10 lookups still applies when a receiver evaluates the record
Enforcement action	You choose p=none, quarantine, or reject. That policy is a request to receivers, not a guarantee a mailbox provider will reject the message. Enforce authorizes senders in the product after DNS is delegated. Monitor reports, and its SPF entitlement is 10 lookups	You choose the same policy ladder, and it is still a request receivers may or may not honor. Dynamic Services is where the records are edited. Express can edit them, and its SPF entitlement stops at 10 lookups
Day-to-day workflow	Read traffic by sending-service name, enable a service on Enforce, then tighten policy once aligned mail is passing	Read the sender view, edit Dynamic Services, use Investigate to check a change before the next aggregate report, then tighten policy
Deploy	SaaS. DNS delegation for the records Enforce hosts. MTA-STS hosting is an Enforce feature. Monitor does not host that policy	SaaS. One DNS change for Dynamic SPF, then later edits in the product. MTA-STS and TLS-RPT are listed on Dynamic Services, including Express
License/pricing	Monitor is free. Enforce Starter, Premium, and Enterprise are quote-only. Amplify is a separate BIMI add-on. Dollars are in Editions	Express publishes a monthly price, billed annually. Essentials, Enterprise, and Premier do not publish a dollar. Caps are in Editions
Who operates it	DNS delegates the records. The mail owner enables senders. BIMI is a second conversation if Amplify is on the quote	DNS delegates once. The mail owner edits records in OnDMARC. A dedicated account manager is named on Enterprise and Premier

We read Valimail’s pricing page, the acquisition note, the 12 February 2026 product note, the Enforce MTA-STS help article dated 30 March 2026, Red Sift’s OnDMARC pricing page, the OnDMARC product page, and the 21 July 2026 release note, plus one October 2025 Reddit comment, all on 3 Oct 2026. We did not log into either product, so this is not a hands-on benchmark. Icon-only cells on Valimail’s pricing table did not render as text, so tier marks that were only a checkmark are not treated as confirmed.

Valimail

Red Sift OnDMARC

DigiCert acquired Valimail on 16 September 2025. The product is still sold as Valimail. The logo on valimail.com reads “a DigiCert company,” and the 12 February 2026 note still signs the company as Valimail, a DigiCert company. Red Sift is still independent. No closed acquisition of Red Sift turned up on its own site the same day.

Editions and pricing

Use the public rows as plan gates, not as a finished order. Valimail does not post an Enforce dollar. Red Sift posts one number, on Express, and leaves the other three tiers as a conversation.

	Valimail	Red Sift OnDMARC
How you buy it now	Monitor is a free account, not a timed trial: the pricing page says no credit card. Enforce is Starter, Premium, or Enterprise, each “contact us.” Amplify is an add-on for BIMI on top of Enforce	Four SaaS tiers. The product page shows a 14-day free trial button. The pricing page says a free trial will suggest a package from your volume, and it marks Express “No Credit Card Required.” Treat those as two pages, not one contract term
Public units (3 Oct 2026)	No public dollar. Monitor: 5 users and 10 SPF lookups. Paid Enforce: unlimited users and unlimited SPF on Starter, Premium, and Enterprise. Subdomain management and reporting start at Premium. The Enterprise column blurb includes API access. Starter and Premium list API as an add-on	OnDMARC Express, the included product, starts at 9 USD per month, billed annually. The pricing page also offers EUR, GBP, and AUD. That figure is the starting price of the Express plan, not a per-domain rate and not a yearly total. Caps included on Express: up to 4 domains, up to 1 million emails a month, 30 days of history, and a plan cap of up to 10 SPF lookups. Essentials, Enterprise, and Premier publish no dollar. Essentials includes 25 active sender domains, upgradable, unlimited email volume, unlimited parked domains, 1 year of history, and unlimited SPF lookups as the plan entitlement
What the invoice covers	Monitor is visibility inside 10 lookups. It does not include unlimited Instant SPF, automated DKIM key edits, or hosted MTA-STS. Those sit on Enforce. BIMI certificate work sits on Amplify, not on the Enforce column	Express includes Dynamic Services for DMARC, SPF, DKIM, MTA-STS, TLS-RPT, and BIMI records, inside the caps above. Unlimited Dynamic SPF starts at Essentials. Enterprise and Premier add one VMC. Premier adds DNS Guardian. Do not read the Express price as those lines
Main buying consideration	Will finance sign an Enforce quote before anyone treats Monitor as the enforcement project?	Is the Express plan enough, at its starting price of 9 USD per month billed annually, for four domains and a plan cap of 10 SPF lookups, or do you need the unpublished tier where unlimited Dynamic SPF is the entitlement?

The protocol limit and the plan cap

	Valimail	Red Sift OnDMARC
What the lookup returns	On Enforce, Instant SPF is the plan entitlement. Valimail says the response is a macro, built for that query, and that it does not flatten vendor IPs into the TXT record. Monitor’s entitlement is 10 SPF lookups. That row on the pricing table is the plan, not RFC 7208	Dynamic SPF, one include, on the tiers that include it. Red Sift says the include flattens at query time and does not use macros. Express’s entitlement is up to 10 SPF lookups. Unlimited Dynamic SPF is the Essentials, Enterprise, and Premier entitlement. The help article says the service still serves the answer inside the protocol limit of 10
Where you add a sender	Enforce: enable a known sending service in the app after the record is delegated. Monitor: you still edit DNS yourself, and a new include can push you through the cap	Dynamic Services, after the one DNS change. Express can make that edit inside a plan cap of 10 SPF lookups. A PermError is the receiver’s result when evaluation crosses RFC 7208, which is not the same fact as the plan cap
What the two vendors disagree on	Valimail’s pages reject IP flattening as the fix. A competitor page that calls Instant SPF “automated flattening” does not match Valimail’s own description	Red Sift’s product page says skipping macros is what keeps the record compatible with legacy gateways. That compatibility claim was not tested here
Main buying consideration	Will the mail gateways you send through accept an SPF macro?	Do you want the query-time IP answer, and is the tier above Express in the budget?

DKIM alignment and p=reject

	Valimail	Red Sift OnDMARC
DKIM	Enforce can add, remove, or modify public DKIM keys in the app. The Enterprise column adds a DKIM continuous-protection report on key age, usage, and length. The 12 February 2026 note places that reporting on Enforce Enterprise, with Amplify updates for subdomain logos, a logo library, and a marketer role	DKIM is part of Dynamic Services on the published tiers. Investigate is the check Red Sift says can confirm a DNS change without waiting for the next day’s aggregate report
Moving the policy	Same ladder: p=none, then quarantine, then reject, after aligned mail passes. The pricing page states enforcement in 60 days or less. That is Valimail’s timeline, not a clock we ran	Same ladder. The product page states 6 to 8 weeks to enforcement. That is Red Sift’s timeline, not a clock we ran
MTA-STS and BIMI	Hosted MTA-STS is Enforce only, per the help article dated 30 March 2026. TLS reporting is described for Monitor and Enforce. BIMI is Amplify, which hosts a VMC or a CMC and publishes the BIMI record. It is not a Monitor feature	Dynamic Services lists MTA-STS, TLS-RPT, and BIMI management from Express upward. Enterprise and Premier list one VMC. 21 July 2026: Analyst View, a portfolio pivot of DMARC data, for those two tiers. DNS Guardian, the dangling-DNS check, is a Premier line
Main buying consideration	Is BIMI an Amplify line on the Enforce quote, with MTA-STS hosting included only after you leave Monitor?	Do you need the VMC and Analyst View on Enterprise or Premier, or is Express record-management enough?

The comment records a move off Valimail for cost, a dangling-DNS check, and BIMI with a CMC the writer says was included. It does not compare Instant SPF with Dynamic SPF. DNS Guardian is a Premier feature on the pricing page, and the VMC line is Enterprise and Premier. A CMC is not a row on that page. Confirm the certificate and the DNS check on the order before treating either as included.

Choose Valimail when the SPF answer has to be Instant SPF on Enforce, Monitor is only the free look at 10 lookups, and BIMI is an Amplify add-on you are willing to quote. Choose Red Sift OnDMARC when the SPF answer has to be Dynamic SPF without macros, on a tier above Express if the lookups must be unlimited, with MTA-STS in Dynamic Services and a VMC only once you are on Enterprise or Premier.